[Benimanela]

Summary

• Refactored CrowdStrike Falcon playbooks from the legacy Incidents model to the new NGSIEM Cases model
• Added new playbook CrowdStrike Falcon - Get Detections by Case to replace the deprecated Get Detections by Incident
• Updated the CrowdStrike Falcon Mapper with new field mappings for NGSIEM Cases (External Category Name, External System ID)
• Replaced deprecated commands:
  • cs-falcon-list-incident-summaries → cs-falcon-list-case-summaries
  • cs-falcon-resolve-incident → cs-falcon-resolve-case
• Added cs-falcon-add-case-tag for case tagging in False Positive and True Positive handling flows
• Added IsIntegrationAvailable checks at playbook entry points
• Migrated context paths:
  • CrowdStrike.Incidents.* → CrowdStrike.Case.*
• Updated all READMEs to reflect new commands, sub-playbooks, inputs, and outputs

---

Affected Files

File	Change
CrowdStrike Falcon - Get Detections by Case	New playbook — retrieves detection details by case ID
CrowdStrike Falcon - SIEM ingestion Get Incident Data	Replaced incident commands and sub-playbooks with case equivalents
CrowdStrike Falcon Malware - Incident Enrichment	Replaced detection retrieval logic, renamed input to DetectionOrCaseID
CrowdStrike Falcon Malware - Investigation and Response	Updated sub-playbook references and formatting
CrowdStrike Falcon - False Positive Incident Handling	Added case resolution and tagging flow
CrowdStrike Falcon - True Positive Incident Handling	Added case resolution and tagging flow
CrowdStrike Falcon Mapper 6.5	Added NGSIEM Case field mappings and alphabetized fields

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Related Issues

Description

Must have

• Tests
• Documentation